Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,443
11,831
5,875
5,151
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects network connections or DNS queries to known lookalike domains utilized by UNC6671 (BlackFile) for adversary-in-the-middle (AiTM) credential harvesting and real-time MFA bypass during vishing operations.
This rule detects DNS requests to hyphen mirrored domains. This tactic has been seen from Silver Fox to deliver the Atlas RAT via Weaponized VPN Installers. Known bad according to the Hexastrike article
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
Tycoon2FA Domain Network Traffic
Cortex XDR
Detects DNS queries or network connections resolving to known Tycoon2FA credential harvesting, kill switch, and link management domains post-takedown. This rule specifically targets precise indicators of compromise (IoCs) associated with the rebuilt Tycoon2FA infrastructure.
Tycoon2FA Malicious S3 Lure Access
Cortex XDR
Detects DNS queries pointing to a specific malicious AWS S3 bucket URL known to be utilized by the Tycoon2FA threat actor for hosting initial cloned Microsoft Power Pages lures. This rule identifies network activity attempting to resolve this highly specific Indicator of Compromise (IOC).
Detects network connections, DNS queries, or web requests to domains associated with the Mini Shai-Hulud supply-chain attack.
This attack compromised multiple npm and PyPI packages (such as TanStack, Mistral AI, and UiPath) with a payload that exfiltrates harvested credentials to the Session messaging protocol's file server and downloads additional stages from attacker-controlled domains.
This attack compromised multiple npm and PyPI packages (such as TanStack, Mistral AI, and UiPath) with a payload that exfiltrates harvested credentials to the Session messaging protocol's file server and downloads additional stages from attacker-controlled domains.
Detects network connections to the Session P2P exfiltration infrastructure used by the Mini Shai-Hulud campaign.
Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign.
The domain git-tanstack.com is attacker-controlled. The filev2.getsession.org endpoint is used
for credential exfiltration via the Session protocol.
The domain git-tanstack.com is attacker-controlled. The filev2.getsession.org endpoint is used
for credential exfiltration via the Session protocol.
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
Detects network connections to known REF6598 staging and command-and-control infrastructure, including a hardcoded staging IP and PHANTOMPULSE panel domains. This provides a high-fidelity signal of active PHANTOMPULSE infections and potential data exfiltration attempts.
Detects DNS requests or network connections to the typosquatted domain and hardcoded IP associated with the DAEMON Tools supply chain attack, as well as additional network relations tied to the installer.
Detects DNS lookups and outbound network connections to known PhantomRaven command and control (C2) infrastructure, including specific domains and IP addresses. The rule also specifically identifies potential data exfiltration attempts to the '/mozbra.php' endpoint.
Detects the Node.js process making external DNS requests to api64.ipify.org, a behavior used by the PhantomRaven payload to discover the host's public IP address.
Detects DNS queries or network connections to known PhantomRaven Wave 5 command-and-control infrastructure (domains and IP addresses). This rule identifies communication with specific malicious domains and IP addresses associated with the PhantomRaven campaign, indicating potential compromise or attempted communication with adversary infrastructure.
Detects Node.js processes querying public IP-address and geolocation lookup services. This automated reconnaissance behavior is the standard "where am I" primitive used by an enormous range of Node-based malware and supply chain campaigns including PhantomRaven (npm), Shai-Hulud, the Bitwarden CLI compromise, Ultralytics-style attacks, and countless commodity Node-based stealers and droppers. Legitimate Node applications rarely query public IP services from developer endpoints — when they do, it is most often during malicious package install lifecycle hooks or within fileless droppers fetched from attacker-controlled C2 servers.
Detects DNS queries or network connections to known PhantomRaven Wave 5 command-and-control infrastructure (domains and IP). This rule specifically looks for connections to 'pack.nppacks.com', 'hblnew.ecompk.com', or the IP address '54.160.138.70'.
Flags Sysmon DNS query events (EID 22) for several weak DGA / DNS-tunnel style heuristics: very long first label, many dot-separated labels, a long alphanumeric prefix (encoded-chunk style), or a suffix on budget/phishing-heavy gTLDs and alternate naming TLDs. Noisy by design — align thresholds with Suricata custom rules in suricata/custom/detecton-lab-dns-dga-hints.rules. Does not replace resolver analytics, ET DNS rules, or ML DGA classifiers.
This rule detects DNS requests to hyphen mirrored domains. This tactic has been seen from Silver Fox to deliver the Atlas RAT via Weaponized VPN Installers. Known bad according to the Hexastrike article
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
Detects DNS resolution requests for the known Nexcorium C2 domain. The Nexcorium Mirai variant relies on this command-and-control server to receive attack parameters for large-scale DDoS campaigns.
Detects DNS resolution requests for the known Nexcorium C2 domain. The Nexcorium Mirai variant relies on this command-and-control server to receive attack parameters for large-scale DDoS campaigns.
Detects DNS requests to file.io originating from non-browser processes, indicative of data exfiltration, potentially by tools like CompactGopher. The rule identifies DNS requests for file.io or its subdomains, joins them with process information, and then filters out common web browsers to highlight suspicious activity.
Detects instances where 'explorer.exe' initiates network connections to domains associated with Cloudflare Tunnel (trycloudflare.com). This behavior can indicate the use of tunneling software, potentially for malicious purposes such as command and control, data exfiltration, or bypassing network restrictions. While Cloudflare Tunnel has legitimate uses, its connection by 'explorer.exe' is unusual and warrants investigation.
Page 58 of 77